A secure, Unicode-compliant command line pastebin server for sharing terminal output and text snippets.

Fork Notice: This project is a fork of fiche by solusipse (MIT licensed), re-licensed under BSD 3-Clause. We have significantly modified the original work with modern security practices and UTF-8 support.

What is agglutino?

agglutino is a lightweight TCP server that receives text via netcat and saves it as web-accessible pastes. It strictly follows the Unix philosophy of doing one thing well.

Security Features

• Input validation and sanitization - rejects invalid UTF-8, removes dangerous control characters
• Homograph attack detection - warns about look-alike characters used for spoofing
• Cryptographically secure randomness - paste URLs are unpredictable (from /dev/urandom or getentropy)
• Compiler protections - stack protection, FORTIFY_SOURCE, PIE, full RELRO
• Privilege dropping - can run as unprivileged user after binding to port
• TOCTOU protection - atomic file operations using mkstemp and O_NOFOLLOW
• Path traversal protection - rejects paths containing ..
• Unicode safety - handles international text securely, prevents RTLO attacks

Perfect for sharing terminal output, logs, code snippets, or any text content securely.

Platform

Primary Development Platform: OpenBSD
Target Compatibility: Unix-like systems (BSDs, Linux, macOS)

agglutino is developed primarily on OpenBSD with a focus on security-first design. It uses OpenBSD-specific sandboxing features (pledge/unveil) when available, but maintains compatibility with other Unix-like systems.

Quick Start

Client (sending text)

echo hello world | nc agglutino.zw.is 9999

Output: http://agglutino.zw.is/a3k9m2p1

Server (receiving text)

fossil clone https://code.lewman.com/agglutino/ agglutino.fossil
mkdir agglutino && cd agglutino
fossil open ../agglutino.fossil
make
./agglutino -o /tmp/pastes

See USAGE.md for detailed client and server usage.

Installation

Requirements

• C compiler with C23 support (Clang 16+ or GCC 13+)
• OpenBSD: pledge/unveil support (optional but recommended)
• Linux/BSD: standard POSIX environment
• Client: netcat (nc)

Build

make          # Build with Clang (default)
make gcc      # Build with GCC

Install

sudo make install

Configuration

agglutino runs without configuration, using sensible defaults:

• Port: 9999
• Output directory: ./code
• Slug length: 8 characters
• Buffer size: 32KB
• Listen address: All interfaces (dual-stack IPv4/IPv6)

See USAGE.md for all options and web server configuration examples.

Security

agglutino implements multiple layers of security:

1. Input validation - UTF-8 validation, control character sanitization
2. Sandboxing - OpenBSD pledge/unveil when available
3. Resource limits - configurable buffer sizes (1KB-128KB)
4. Privilege separation - drops root after binding to port
5. Cryptographic safety - unpredictable paste URLs

The codebase has been audited with:

• scan-build (Clang static analyzer)
• cppcheck
• flawfinder

Demo Server

https://agglutino.zw.is

echo hello | nc agglutino.zw.is 9999

License

Agglutino is BSD 3-Clause licensed. See LICENSE for details.

This project is a fork of fiche (MIT licensed). The original work is Copyright (c) 2013 solusipse.

Etymology

From Latin agglutino: "to paste to something". From Italian agglutinare.

AI/LLM Policy

We welcome patches written by anyone, including AI/LLM-assisted development. Parts of this codebase were written with assistance from AI models. All code is reviewed and approved by humans who take responsibility for submissions.